Heineken’s new chief executive, Rafael Oliveira, wants a stronger performance culture and, to that end, also wants to simplify the organisational structure (Het Financieele Dagblad, 29 October 2026). On taking office, Heather Polinsky, the CEO of Arcadis, said she wants to combine technical expertise more explicitly with commercial strength (Het Financieele Dagblad, 16 March 2026). They are not alone. At Switzerland’s Nestlé, America’s Boeing and Japan’s Nissan, too, executives are talking openly about cultural change. These are visible examples of an issue that undeniably plays out in many more companies. The ambitions differ, but the underlying idea is similar: a new direction calls not only for different plans and processes, but also for different behaviour.
That idea is not new. For risk and assurance professionals, however, it raises a fundamental question: do we have sufficient insight into the behaviours that determine whether the strategy is realised, and into the new risks that arise when executives want to change the organisational culture?
Culture as a strategic factor
Strategy, governance, Risk Management and culture are inextricably linked. Strategy sets the direction, governance defines frameworks and responsibilities, and Risk Management supports trade-offs. But culture influences how people actually make decisions, work together, take risks and deal with challenge. Culture can strengthen the realisation of strategic ambitions, or undermine it. Even well-designed controls lose their meaning if behaviour does not match them.
The flip side of cultural change
Cultural change does not automatically mean improvement. A stronger focus on results can boost performance, but it can also provoke short-term thinking, undue pressure, fraud and unethical behaviour. At an Ecuadorian subsidiary of the Dutch company Nutreco, revenue figures were manipulated. According to reporting in 2025 on a forensic investigation, revenue targets, bonuses and a hierarchical culture with little room for challenge played a part. The case illustrates how performance targets, incentives and existing cultural traits can reinforce each other to the point where serious conduct risks arise.
The task is therefore twofold: understanding whether the existing culture supports the most important ambitions, and recognising which new risks arise from the interventions with which management wants to change that culture. Precisely when a new direction is widely embraced, it is important that risk and assurance professionals remain critical of its possible unintended effects.
From professional standards to board relevance
The professional foundation is there. ISO 31000 (2018) recognises the importance of human and cultural factors. COSO ERM (2017) links culture to strategy, governance and performance. New COSO guidance (2026) also stresses that Risk Management must carry through into decision-making, not merely into documentation. For internal audit, the IIA practice guide Auditing Culture (2024) offers practical guidance. The Organizational Behavior Topical Requirement, which takes effect on 15 December 2026, sets additional requirements for applicable assurance engagements. Organisational behaviour is a subset of the broader concept of organisational culture.
But standards and methods do not by themselves tell us where to look. Do we understand which interests weigh most heavily for the executive and supervisory boards, and where culture can support or threaten those interests? Or do familiar audit topics, risk registers and reporting cycles narrow our field of vision? That insight is not handed to us. It requires ongoing inquiry: asking further questions in the line, seeking out different perspectives, observing decisions and behaviour, and taking contradictory signals seriously.
For internal audit, this means that culture and behaviour should not be regarded solely as a standalone audit topic. Within regular audits too, it is important to examine the extent to which leadership, incentives and actual behaviour contribute to risks arising or being insufficiently controlled. Commercial targets may, for example, encourage undesirable behaviour, or a lack of challenge may undermine the quality of decision-making. Culture thus gains a place in the assessment of the effectiveness of risk control, without every audit having to become a culture audit.
Management remains responsible for culture and risk control. Risk Management helps to examine assumptions, incentives and side effects in a forward-looking way; internal audit can independently assess whether relevant risks are recognised and controlled. Their roles differ; their relevance shows in their contribution to the board’s deliberations.
Five recommendations for practice
- Start with what weighs most. Determine which strategic objectives and other material interests deserve priority. Examine which values and behaviours are indispensable for them. Reassess those priorities when circumstances change.
- Look for where alignment chafes. Do values match ambitions? Do structure, leadership and remuneration support the desired behaviour? And is that borne out in practice? Pay particular attention to new tensions caused by change measures.
- Let vulnerability determine the focus. Ask what damage cultural shortcomings could do to material interests. Examine relevant risk factors, without letting the false precision of probability scores take the lead.
- Test whether we know enough. Compare management information with observations and findings from different disciplines. The more vulnerable the company is to culture-related risks, the higher the demands on the quality, diversity and independence of the insight.
- Take the trade-off back to the executive and supervisory boards. Which risks are acceptable, which uncertainties are not? Make visible where adjustment, monitoring or additional independent assessment is needed.
In closing
Organisations without their own Risk Management or internal audit function also have to deal with these issues. Targeted external support can provide missing insight or independent assessment, but can equally strengthen existing functions where specific expertise or experience is lacking.
Ultimately, the question is not only whether culture has a place in our audit plan or risk register, but whether we truly understand where culture and behaviour can make or break the company’s ambitions. That insight does not arise by itself. It requires us to look beyond the usual information and to investigate for ourselves which issues may remain outside the field of vision of the executive and supervisory boards. Sometimes our added value begins precisely with raising and investigating questions that no one has yet asked, even when that meets with resistance or incomprehension.
About the authors
Steven Brassem worked for more than thirty years in governance, Risk Management and assurance at international groups, including as the executive with final responsibility for risk and audit. He supported boards and executives in getting to the bottom of complex issues and making decisions under uncertainty. He now brings that practical experience together in advisory work and publications focused on careful board decision-making.
Robert Bogtstra is a partner at ONE Risk Advisory and co-founder of ONE Risk Advisory (2012), a registered accountant (RA) and Certified Internal Auditor (CIA), and accredited by The IIA for External Quality Assessments. Since 2015 he has been a core lecturer in Corporate Governance at Nyenrode Business University.
About ONE Risk Advisory
ONE Risk Advisory is a specialised firm for Risk Management and Internal Audit that works exclusively with experienced specialists. We help boards and management strengthen governance and risk control, with the aim of better and well-founded decision-making.
- Risk Management: Risk Insight, Governance & Control Design, Embedding & Transformation and Optimisation & Assurance Readiness.
- Internal Audit: External Quality Assessment (EQA), Quality Improvement and Internal Audit Support.
We would be pleased to discuss the options for your organisation. Schedule a meeting.
Frequently asked questions
What is the IIA Organizational Behavior Topical Requirement?
The Organizational Behavior Topical Requirement of The IIA sets additional requirements for internal audit in applicable assurance engagements. It was issued on 15 December 2025 and takes effect on 15 December 2026. The IIA describes organisational behaviour as the observable choices employees make in doing their jobs and how they work with others, and regards it as a subset of the broader concept of organisational culture.
Why does culture matter for risk control?
Culture influences how people actually make decisions, work together, take risks and deal with challenge. It can strengthen the realisation of strategic ambitions, or undermine it. Even well-designed controls lose their meaning if behaviour does not match them.
What risks does cultural change bring?
Cultural change does not automatically mean improvement. A stronger focus on results can boost performance, but it can also provoke short-term thinking, undue pressure, fraud and unethical behaviour. It is therefore important to understand whether the existing culture supports the most important ambitions, and to recognise which new risks arise from the interventions with which management wants to change that culture.
Should internal audit audit culture as a separate topic?
Not exclusively. Within regular audits too, internal audit can examine the extent to which leadership, incentives and actual behaviour contribute to risks arising or being insufficiently controlled. Culture thus gains a place in the assessment of the effectiveness of risk control, without every audit having to become a culture audit.
Which frameworks address culture in Risk Management and internal audit?
ISO 31000:2018 recognises the importance of human and cultural factors, and COSO ERM 2017 links culture to strategy, governance and performance. For internal audit, The IIA’s Global Practice Guide Auditing Culture (second edition, July 2024) offers practical guidance, and from 15 December 2026 the Organizational Behavior Topical Requirement applies.